CN108141704A - The station location marker of former network message handling device - Google Patents

Abstract

The network message is transmitted from the first network node at the particular location to the second network node in a manner that enables the second network node to determine that the network message is processed by the computing system at the particular location. For example, a specific location may be a geographic location or a network topology location. Proof of location is done by using signed proof of location which is included by the first network node within the network message. The network message is then received by the second network entity. The second network entity then uses the signed location data structure evidence as input to a process of determining that the network message was processed based at least on the signed location data structure evidence.

Description

The location identifier of the previous network message handler

Background technique

Computing systems and associated networks have revolutionized the way humans work, play and communicate. Computer systems affect almost every aspect of our lives in some way. The proliferation of networks has allowed computing systems to share data and communicate, greatly increasing information access. For this reason, the present age is often referred to as the "Information Age".

However, computing networks are often widely distributed and span multiple trust boundaries. For example, computing systems within the boundaries of a particular company may be trusted by that company more than computing systems outside of the company's boundaries. Furthermore, computing systems within a particular department of a company may be more trusted than computing systems in other departments of the company. Therefore, it is important to reconsider and enforce trust boundaries in order to ensure security. Therefore, in determining whether to provide services and/or information to a particular computing system, it is helpful to determine whether the computing system is within a certain trust boundary.

One conventional mechanism for estimating whether a computing system is within a particular trust boundary is based on the source Internet Protocol (IP) address of messages requesting services and/or information. If the source IP address identifies a computing system within the trust boundary, then a certain higher level of trust is assigned to messages received from this computing system. Accordingly, conventional techniques allow computing systems to communicate in a more trusted manner when these computing systems reside in the same trust boundary. Therefore, services and information based on this trust can be mutually provided.

The subject matter claimed herein is not limited to embodiments that solve any disadvantages or that only operate in environments such as those described above. Rather, this background is provided merely to illustrate one exemplary technology area in which some embodiments described herein may be practiced.

Contents of the invention

At least some embodiments described herein relate to communicating a network message from a first network node at a particular location to a second network node in a manner that enables the second network node to determine that the network message was processed by a computing system at the particular location. For example, a specific location may be a geographic location or a network topology location. A particular location may include multiple computing systems.

The proof of location is done by using the signed proof of location included by the first network node within the network message. The network message is then received by the second network entity. The second network entity then uses the signed location data structure evidence as input to a process of determining that the network message was processed based at least on the signed location data structure evidence. If the location is trusted, the second network node may allow certain technical actions to be performed on the received network message.

In one embodiment, the first network entity obtains the signed location data structure evidence from an Internet Protocol (IP) address assignment server corresponding to the address range and assigning the IP address to the first network entity. The IP address assigning server may negotiate, publish or otherwise inform the second network entity how to verify the signature and extract the contents of the signed location data structure evidence. Therefore, the signed location data structure evidence is at least tamper-proof, if not completely tamper-proof. In some embodiments, the signed location data structure evidence may be compared to an IP address associated with a first network node within the network structure to ensure that they match before the second network node makes a location determination.

This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

Description of drawings

In order to describe the manner in which the above and other advantages and features can be obtained, a more particular description of various embodiments will be presented by referring to the accompanying drawings. With the understanding that these drawings depict example embodiments only and are therefore not to be considered as limiting the scope of the invention, the embodiments will be described and explained with additional features and details by using the accompanying drawings, in which:

Figure 1 abstractly illustrates a computing system in which some embodiments described herein may be employed;

Figure 2 illustrates an environment comprising a first network node having a network in communication with a second network and located within a particular location;

Figure 3 illustrates a method for a first network node of a location to initiate transmission of a network message to a second network node in a manner that enables the second network node to determine that the message is processed by a computing system within the location of the first network node flow chart;

Figure 4 illustrates a network message including signed evidence of a location data structure;

Fig. 5 shows a flowchart of a method for a first network node to obtain a signed location data structure evidence;

Figure 6 illustrates an environment with a location including an address assignment server having an associated address range from which a server can be selected to assign an address to each of a plurality of network nodes; and

Fig. 7 schematically shows location data structure evidence.

Detailed ways

At least some embodiments described herein relate to communicating a network message from a first network node at a particular location to a second network node in a manner that enables the second network node to determine that the network message was processed by a computing system at the particular location. For example, a specific location may be a geographic location or a network topology location. A particular location may include multiple computing systems.

The proof of location is done by using the signed proof of location included by the first network node within the network message. The network message is then received by the second network entity. The second network entity then uses the signed location data structure evidence as input to a process of determining that the network message was processed based at least on the signed location data structure evidence. If the location is trusted, the second network node may allow certain technical actions to be performed on the received network message.

In one embodiment, the first network entity obtains the signed location data structure evidence from an Internet Protocol (IP) address assignment server corresponding to the address range and assigning the IP address to the first network entity. The IP address assigning server may negotiate, publish or otherwise inform the second network entity how to verify the signature and extract the contents of the signed location data structure evidence. Therefore, the signed location data structure evidence is at least tamper-proof, if not completely tamper-proof. In some embodiments, the signed location data structure evidence may be compared to an IP address associated with a first network node within the network structure to ensure that they match before the second network node makes a location determination.

Some introductory discussion of the computing system will be described with reference to FIG. 1 . Then, the transmission of a network message from a first network node to a second network node such that the position of the first network node can be determined will be described with reference to subsequent figures.

Computing systems now increasingly take a variety of forms. For example, a computing system may be a handheld device, a home appliance, a laptop, a desktop computer, a mainframe, a distributed computing system, a data center, or even a device not generally considered a computing system, such as a wearable device (e.g., Glasses). In this specification and claims, the term "computing system" is broadly defined to include any device or system (or combination thereof) that includes at least one physical and tangible processor and physical and tangible memory capable of having Computer-executable instructions that can be executed by a processor. The memory may take any form and may depend on the nature and form of the computing system. The computing system may be distributed in a network environment and may include multiple constituent computing systems.

As shown in FIG. 1 , in its most basic configuration, computing system 100 typically includes at least one hardware processing unit 102 and memory 104 . Memory 104 may be physical system memory, which may be volatile, non-volatile, or some combination of both. The term "memory" may also be used herein to refer to non-volatile mass storage, such as physical storage media. If the computing system is distributed, processing, memory and/or storage capabilities may also be distributed. As used herein, the term "executable module" or "executable component" may refer to a software object, routine or method that can be executed on a computing system. The various components, modules, engines and services described herein can be implemented as objects or processes executing on the computing system (eg, as separate threads).

In the following description, embodiments are described with reference to acts performed by one or more computing systems. If the acts are implemented in software, the one or more processors (associated with the computing system performing the acts) direct the operation of the computing system in response to having executed computer-executable instructions. For example, such computer-executable instructions may be embodied on one or more computer-readable media forming a computer program product. An example of such operations involves manipulation of data. Computer-executable instructions (and manipulated data) may be stored in memory 104 of computing system 100 . Computing system 100 may also contain a communication channel 108 that allows computing system 100 to communicate with other computing systems over, for example, network 110 . Computing system 100 also includes a display that can be used to display visual representations to a user.

Embodiments described herein may comprise or utilize a special purpose or general purpose computing system comprising computer hardware such as, for example, one or more processors and system memory, as discussed in more detail below. Embodiments described herein also include physical and other computer-readable media for carrying or storing computer-executable instructions and/or data structures. Such computer-readable media can be any available media that can be accessed by a general purpose or special purpose computing system. Computer-readable media that store computer-executable instructions are physical storage media. Computer-readable media that carry computer-executable instructions are transmission media. Thus, by way of example and not limitation, embodiments of the present invention may comprise at least two distinct types of computer-readable media: storage media and transmission media.

Computer-readable storage media include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or means that can be used to store desired program code in the form of computer-executable instructions or data structures and can Any other physical and tangible storage media accessed by a general or special purpose computing system.

A "network" is defined as one or more data links that enable the transfer of electronic data between computing systems and/or modules and/or other electronic devices. When information is transmitted or provided to a computing system over a network or another communication connection (hardwired, wireless, or a combination of hardwired or wireless), the computing system properly views the connection as the transmission medium. Transmission media may include a network and/or data links for carrying desired program code means in the form of computer-executable instructions or data structures and accessible by a general purpose or special purpose computing system. Combinations of the above should also be included within the scope of computer-readable media.

Furthermore, upon reaching various computing system components, program code means in the form of computer-executable instructions or data structures may be automatically transferred from transmission media to storage media (and vice versa). For example, computer-executable instructions or data structures received over a network or data link may be cached in RAM within a network interface module (e.g., a "NIC") and then eventually passed to computing system RAM and/or computing system less volatile storage media. Thus, it should be appreciated that storage media can be included in computing system components that also (or even primarily) utilize transmission media.

Computer-executable instructions comprise, for example, instructions and data which, when executed at a processor, cause a general purpose computing system, special purpose computing system, or special purpose processing device to perform a particular function or group of functions. Alternatively or additionally, computer-executable instructions may configure the computing system to perform a certain function or group of functions. Computer-executable instructions may be, for example, binary files or even instructions that undergo some transformation, such as compilation, such as intermediate format instructions, such as assembly language or even source code, before being directly executed by a processor.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the features or acts described above. Rather, the described features and acts are disclosed as example forms of implementing the claims.

Those skilled in the art will recognize that the present invention may be practiced in network computing environments having many types of computing system configurations, including personal computers, desktop computers, laptop computers, message processors, handheld devices, multiprocessor systems, Microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile phones, PDAs, pagers, routers, switches, data centers, wearable devices such as eyeglasses, etc. The invention may also be practiced in distributed systems environments where both local and remote computing systems that are linked (either by hardwired data links, wireless data links, or by a combination of hardwired and wireless data links) through a network execute Task. In a distributed system environment, program modules may be located in both local and remote memory storage devices.

FIG. 2 shows an environment 200 comprising a first network node 210 and a second network node 220 . The first network node 210 is comprised within a specific location 211 . The first network node 210 transmits a network message 231 (as represented by arrow 232 ) to the second network node 220 via the network 230 . Doing so by the first network node 210 enables the second network node 220 to confirm that the network message 231 was processed within the particular location 211, according to principles described in further detail herein. If such an acknowledgment is made, the second network node 220 may perform a technical action or group of technical actions that would otherwise not be performed without the acknowledgment. For example, the action may be predetermined, such as the second network node 220 logging receipt of the message, placing an action associated with the message in a queue, agreeing to all or part of a request included in or associated with the message, and many more. Other actions may be determined at the same time, such as actions based on current state, load balancing actions, actions selected based on some level of random input, etc.

Specific locations 211 may be geographic locations, which may be defined by any definable geographic boundaries. For example, geographic locations may be defined by political boundaries (eg, Canada, Kansas, etc.), organizational boundaries (eg, Contoso corporate campus), architectural boundaries (eg, building 17), or any other definable geographic or physical boundaries. Specific locations 211 may also be network topology boundaries. For example, a location may be defined to encompass any computing system reachable in a particular manner by a particular computing system or group of computing systems using a particular communication protocol.

Network 230 may be any network over which messages may be communicated. By way of example only, network 230 may be the Internet. Network message 231 may likewise be any network message configured to be transmitted via network 230 . Network messages 231 may exist at any level of the protocol stack. For example, network messages 231 may exist at the Internet layer of the protocol stack, such as, by way of example only, IPv4 messages, IPv6 messages, Internet Control Message Protocol (ICMP) messages, ICMPv6 messages, Internet Group Management Protocol (IGMP) messages, gateway-to-gateway protocol message or any other Internet protocol, whether existing or not yet developed.

However, network messages 231 are not limited to messages identified at any particular level of the protocol stack. For example, network message 231 may alternatively be an application-level message, such as a hypertext transfer protocol (HTTP) message, a transport layer protocol (TLP) message, or any other application-level message, whether such an application or application-level protocol exists today or Not yet developed. Network messages 231 may alternatively be messages identified at the transport level, link layer, or any other level of the protocol stack.

First network node 210 and second network node 220 may each be any system or device capable of transmitting network messages 231 over network 230 . For example, network nodes 210 and 220 may each be any device or system capable of processing network message 231 . By way of example only, a network message may be a client computing system, server computing system, gateway, router, load balancer, proxy server, network address translator, or any other computing device or system. As an example, first network node 210 and second network node 220 may each be configured as described above for computing system 100 of FIG. 1 .

In one embodiment, the first network node 210 is the source of the network message 231 and the second network node 220 is the destination of the network message 231 . However, in an alternative embodiment, as indicated by ellipsis 201 , first network node 210 is not the source of network message 231 , but receives and processes the network message before routing it to second network node 220 . This possibility is further indicated by dashed arrow 241 in FIG. 2 .

Alternatively or additionally, as indicated by the ellipsis 202, the second network node 220 need not be the destination of the network message 231, but instead receives the network message 231 from the first network node 210, processes the network message 231, and further along its path Network message 231 is routed towards the final destination of network message 220 . This possibility is further indicated by dashed arrow 242 in FIG. 2 .

3 illustrates a method 300 for a first network node of a location to initiate transmission of a network message to a second network node in a manner that enables the second network node to determine that the message is processed by a computing system within the location of the first network node. flow chart. Some of the actions of the method 300 may be performed by the first network node 210 of FIG. 2, as shown in the left column of FIG. 3 under the heading "First Node", and include the action numbers in 310. Other actions of the method 300 may be performed by the second network node 220 of FIG. 2, as shown in the right column of FIG. 3 under the heading "Second Node" and include the action numbers in 320.

The first network node obtains a signed location data structure evidence corresponding to the location of the first network node (act 311). For example, the signed location data structure may correspond to the location 211 of the first network node 210 of FIG. 2 . More on location data structure evidence is described further below. It can now be said that the signed location data structure evidence is constructed as input to a process interpretable by the second network node 220 as determining that a network message including the signed location data structure evidence is processed by a computing system within the location 211 .

The first network node then includes the signed evidence of the location data structure within the network message (act 312). For example, FIG. 4 shows a network message 400 that includes a signed location data structure evidence 411 . The first network node 210 may therefore place the signed location data structure proof 411 within the message 400 . The fact that the data structure is signed is represented in Figure 2 by elements with thicker lines.

Unlike traditional techniques, location evidence is not the source IP address itself. Indeed, the network message 400 shows the first network node address 401 of the first network node, which is different from the location data structure evidence 411 . As an example, the first network node address 401 may be the IP address of the first network node 210 .

As previously mentioned, the first network node 210 may be the source of the network message 400 , in which case the first network node 210 also constructs the network message 400 . In that case, location data structure evidence 411 may be placed within network message 400 when network message 400 is constructed or shortly thereafter. Furthermore, network node address 401 will be the source network node address (eg, source IP address) of message 400 .

Alternatively, the first network node 210 may have received and processed the message 400, and in such processing obtained and placed the location data structure evidence 410 within the message 400, as previously described. In that case, the first network node address may be an intermediate address within message 400 (eg, an intermediate IP address).

The first network node then initiates dispatch of a network message to the second network node, the network message including the signed location data structure evidence (act 313). For example, in FIG. 2 , the first network node 210 dispatches a message to the second network node 220 via the network 230 , as indicated by arrow 231 . The dispatched message may be, for example, message 400 of FIG. 4 , which includes location data structure evidence 410 .

In this description, the first network node 210 is described herein as including a single signed location data structure evidence within the network message 400 . However, the first network node 210 may perform actions 311 and 312 multiple times to insert multiple signed location data structure evidences in the network message 400 . This is indicated in FIG. 4 using an ellipsis 412 . The multiple location data structure evidences may relate to the same location 411 , or may relate to different locations attributable to the first network node 210 . Furthermore, multiple signed location data structure evidences may be evaluated by the second network node 220 or each signed location data structure evidence may be processed by a different network node in the path of the network message 231 .

Once the second network entity receives the network message from the first network entity (action 321 ), the second network node verifies that the signed location data structure evidence is signed at the specific location of the first network node (action 322 ). For example, the second network entity 220 verifies that the signed location data structure evidence 411 included in the message is signed within the specific location 211 of the first network node 210 .

Furthermore, to further increase security, the second network node determines that the address of the first network node included in the message is associated with the signature of the signed location data structure evidence (act 323). For example, the second network node 220 determines that the first network node address 401 is associated with the signature of the signed location data structure evidence 411 .

Based on the verification of act 322 or the verification of acts 322 and 323, the second network node determines that the message was processed by a computing system within the location of the first network entity (act 324). For example, the second network node 220 determines that the message 400 was processed within the specific location 211 .

The second network node may then perform a technical action based on this determination (action 325). As examples, such technical actions may include logging receipt of a message, placing an action associated with a message in a queue, granting all or a portion of a request to be included within or associated with a message, and the like.

Although the first network node 210 is described as inserting the signed message into the network message 400, in cases where the first network node 210 is not the source of the network message, the network message may be composed of one or more The first network node 220 of the location data structure evidence is received. These one or more other location data structure evidences are also represented by ellipses 412 in FIG. 4 . Accordingly, the second network node 202 may perform actions 322 to 324 for each of one, some or all of the plurality of location data structure evidences included within the network message for the plurality of locations in the previous path with respect to the network message .

Fig. 5 shows a flowchart of a method 500 for a first network node to obtain a signed location data structure evidence. The method 500 represents one example of how the first network node 210 of Fig. 2 performs action 311 of Fig. 3 . Method 500 may be performed within environment 506 of FIG. 6 . Environment 600 includes a location 601 that includes an address assignment server 610 (eg, an IP address assignment server) with an associated address range 611 . Address assignment server 610 is capable of assigning addresses (eg, IP addresses) in address range 611 to any network node within location 601 .

The location 601 also includes a plurality of network nodes 621 to 624 to which the IP address assignment server 610 can assign IP addresses. Although four network nodes 621 - 624 are shown within location 601 , location 601 may include any number of network nodes, as indicated by ellipses 625 . Thus, in this case location 601 is a network topological location representing all network nodes that can be assigned addresses by IP address assignment server 610 with address range 611 .

One of the network nodes 621 to 624 (eg, network node 621 ) may be the first network node 210 of FIG. 2 . In that case, location 601 is an example of specific location 211 of FIG. 2 . As mentioned above, the method 500 of FIG. 5 is used for the first network node to obtain a signed location data structure evidence. Additionally, the method may be performed in environment 600 of FIG. 6 . Actions performed by a network node (eg first network node 210 , an example of which is network node 621 ) are located in the left column of FIG. 5 under the heading "Network Node" and are marked in 510 . Actions performed by an address assignment server (eg, address assignment server 610 ) are located under the heading "Assignment Server" and are marked in 520A.

According to the method 500, the first network node requests an Address Assignment Server with an associated address range to sign a location data structure evidence (act 511). For example, in Figure 6, network node 621 may request address assignment server 610 to sign and return a location data structure proof. In an embodiment referred to herein as a "DHCP boot embodiment," the address assignment server is a Dynamic Host Configuration Protocol (DHCP) server that assigns IP addresses to network nodes as they boot up and broadcasts requests for IP addresses. Thus, in a DHCP boot embodiment, actions are performed when network node 210 (eg, network node 621 ) boots from a powered-off state. For example, a request for a signed location data structure proof may be interpreted from a normal request for an IP address broadcast by a network node (and received by a DHCP server) when the network node starts up. Thus, the request can be interpreted by the DHCP server as a request for an IP address and a request for a signed proof of location data structure.

The address assigning server then receives the request (act 521). This is indicated by arrow 631 in FIG. 6 . The address assigning server then constructs a location data structure evidence (act 522). FIG. 7 schematically illustrates such a location data structure evidence 700 . The location data structure evidence 700 may include an address 701 assigned to the first network node 510 (e.g., network node 621), an address range 702 of the address assignment server 610, an expiration time 703 for the address 701 assigned to the network node, and an address 703 assigned to the network node. The update time 704 of the address 701 of the node. In a DHCP enabled embodiment, address 701 may be an address assigned concurrently from address range 611 by a DCHP server (an example of address assigning server 610).

The address assigning server then signs the location data structure evidence (act 523). The location data structure evidence is signed with a signature such that the second network node 520 can extract the location data structure evidence. For example, address assigning server 610 and second network node 220 may coordinate such that second network node 220 has a public key associated with a private key held by address assigning server 610, and address assigning server 610 signs location data using this private key structural evidence. The principles described herein are not limited to how this is done. Traditional mechanisms for accomplishing this negotiation include public key infrastructure (PKI) systems. In that case, the address assignment server can negotiate through this system with every possible subsequent network node whose location the first network node 210 can prove. Alternatively, the address assigning server may simply publish the public key, in which case the second node 220 may simply obtain this public key prior to or in response to receiving the network message. Such publishing may occur using the Domain Name System (DNS) system. Alternatively, the public key may already be included within location data structure evidence 700 .

The address assigning server then sends the signed location data structure proof back to the first network node (act 524). In a DNS enabled embodiment, the address assigning server may also send back the assigned IP address to the network node. For example, referring to FIG. 6 , as indicated by arrow 631 , address assigning server 610 provides network node 621 with a signed location data structure evidence (along with a potential assigning address). Then, the first network node receives the signed location data structure evidence.

With more to say about generating evidence of the location data structure of how the signature was generated, more will now be described about how the verification of actions 322 and 323 occurs. To verify that the location data structure evidence was signed at location 211, the second network node 220 first believes that any network node that can assign an address from the address assignment server is indeed topologically co-located. Furthermore, since the second network node 220 has a public key corresponding to the private key used by the address assignment server to sign the location evidence, the location evidence is tamper-proof or at least tamper-proof. That is to say, if the public key cannot be used to extract the location evidence from the signed location data structure evidence, the second network node determines that the signed location data structure evidence has been tampered with. Once the second network node extracts the location data structure evidence using the public key associated with the address assignment server, the second network node can then verify that the network node address 701 is indeed within the address range of the address assignment server.

Alternatively or additionally, the second network node 220 does not pre-possess a public key corresponding to the private key used by the address assignment server. In this case, the signed location data structure evidence 700 carries the public key or the name of the address assignment service.

Furthermore, for action 323, the second network node verifies that the actual network address 401 included in the network message 411 feasibly falls within the address range. The name or public key in the signed location data structure evidence is compared to a set of trusted address assignment servers at the second network node. If a match is found, the matching public key is considered authentic. Signature verification typically involves recomputing a digest of the location information, then manipulating the signature value with the public key, and finally comparing it to the digest value. In general, the location data structure is always accessible in the clear, with a signature proving that (a) it was issued by a trusted source and (b) it was not modified in transit. Alternatively, this can be checked by simply verifying that the network address 401 is the same as the network address 701 included in the location data structure evidence or that the network address is within the address range 702 of the data structure. In some embodiments, the address range 702 need not be placed within the location data structure evidence, but is simply a piece of information that the second network node has determined based on previous negotiations with the address assigning server (e.g., via the DNS system or PKI system). This final verification of act 323 prevents the constructed signed location data evidence from being copied from one message to another.

In some embodiments, various processes between the first network node and the second network node may change the network address 401 . For example, load balancers, proxy servers, network address translators, and other processes may change network address 401 . In this case, however, the network address 401 is saved in some other part of the network message 400 or in an aggregation of the network message 400 with other network messages. For example, assume network message 400 is an IP packet. Application-level HTTP messages can be recovered by aggregating various IP packets. The X-Forwarded-For header of the HTTP message may hold the network address 401, which would otherwise be written by such an intermediate process.

As mentioned above, the location data structure evidence may be bound to the first network node 210 . This may be done by including a piece of information within the proof of location bound to the first network node. For example, when requesting location data structure evidence from the address assignment server, the first network node may derive the information based on its Trusted Platform Module (TPM). This could be an actual physical TPM residing on the first network node, or it could be a software emulation of the TPM.

The invention may be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. The described embodiments are to be considered in all respects only as illustrative and not restrictive. The scope of the invention is, therefore, indicated by the appended claims rather than by the foregoing description. All changes that come within the meaning and range of equivalency of the claims are intended to be embraced therein.

Claims (10)

1. A computer-implemented method for a first network node located at a location to initiate a message to a second network node in a manner that enables a second network node to determine that the message is to be processed by a computing system within the location A transmission of a node, the computer-implemented method being performed by one or more processors executing computer-executable instructions for the computer-implemented method, and the computer-implemented method comprising: Said first network node obtains a signed location data structure evidence corresponding to said location of said first network node, said signed location data structure evidence constructed to be interpretable by said second network node as determining said message is input to a process processed by a computing system within said location; said first network node includes said signed location data structure evidence within said message; and Said first network node initiates dispatch of said message comprising said signed location data structure evidence to said second node, enabling said second network node to process at least said signed location data structure evidence based on determining that the message was processed by a computing system within the location of the first network node, and enabling the second network node to perform a technical action based on the determination. 2. The computer-implemented method of claim 1, wherein the first network node causes the message. 3. The computer-implemented method of claim 1, wherein the first network node receives and processes the message before routing the message to the second network node. 4. The computer-implemented method of claim 1, said first network node obtaining signed location data structure evidence comprising: said first network node requests an address assignment server signed location data structure evidence associated with an address range; and The first network node receives the signed location data structure evidence in response to the request. 5. The computer-implemented method of claim 1 , wherein the location data structure evidence is signed by an address assignment server having an associated address range that includes an address assigned to the first network node . 6. The computer-implemented method of claim 1, wherein the location data structure evidence includes an address assigned to the first network node. 7. The computer-implemented method of claim 1, wherein the message further includes an Internet Protocol (IP) address of the first network node. 8. The computer-implemented method of claim 1, wherein the location is a geographic location. 9. The computer-implemented method of claim 1, wherein the location is a network topology location. 10. A computing system comprising: one or more processors; One or more computer-readable media comprising computer-executable instructions that, when executed by the one or more processors, cause the computing system to utilize The architecture is operable upon receipt of a network message comprising a signed location data structure evidence corresponding to a location of a first network node: verifying that the signed location data structure evidence was signed at the location of the first network node; and It is determined at the second network node based on the verification that the message was processed by a computing system within the location of the first network entity, such that the second network node is able to perform a technical action based on the determination.